Case file: iRhythm Holdings, Inc.

Name: iRhythm Holdings, Inc. data breach case file
Creator: BreachTally

Every government filing on this incident, the dates as stated, and the days to notice against each state's statute. Built from the records on Nov 15, 2026, agency link on every row. Not legal advice.

Buy the Word document, US$49 Every case file with a plan All filings by iRhythm Holdings, Inc.

One payment, no subscription. The document is emailed at once and its link keeps it current for 30 days as more states file.

The incident

Breach window: Jun 8, 2026
Discovered: Jun 8, 2026, as stated in the SEC Form 8-K letter
First public signal: Jun 15, 2026, when iRhythm Holdings, Inc. told investors of a cyber incident in an SEC Form 8-K (Item 1.05). No agency record of the incident is on file yet
State and federal records: 1 filing, Jun 15, 2026
Residents counted: No state publishes a resident count for this incident
Everyone affected: No filing gives a total
Information exposed: Financial / bank account, Medical / health information
Offered to those affected: No monitoring offer found in the letters we read
Third party named: Yes, the letter attributes the incident to a vendor or service provider

The letter: "On June 8, 2026, iRhythm Holdings, Inc. (the “Company”) identified unauthorized activity involving data maintained on certain third-party-hosted business applications."

The investor filing: Form 8-K of Jun 15, 2026. An 8-K is tied to the incident by the company and the dates, so read it before relying on it. It says: "On June 8, 2026, iRhythm Holdings, Inc. (the “Company”) identified unauthorized activity involving data maintained on certain third-party-hosted business applications. The Company promptly activated its cybersecurity response plan and launched an investigation with the support of external advisors and cybersecurity experts to assess and contain the threat."

Filings

Agency	Record date	People	In total	Days to notice	Links
SEC Form 8-K SEC Form 8-K	Jun 15, 2026	Not published		7 days	8-K Record

People is the count the filing gives, residents of the state unless marked total. Days to notice runs from the discovery date the letter states, or from the end of the breach window when no letter states one, to the date on the state's first record of the incident. "Over" marks a count past the days the state's statute allows for notice to residents. The statute's trigger is a question of fact, the days are arithmetic.

Filings by others that name iRhythm Holdings, Inc.

Clients of a breached vendor often file under their own names and name the vendor.

iRhythm Technologies Inc., Oregon, Oct 6, 2026, 8,179,772
iRhythm Technologies Inc., Texas, Oct 6, 2026, 298,647
iRhythm Technologies Inc., California, Oct 6, 2026
iRhythm Technologies Inc., Washington, Oct 6, 2026, 220,745
iRhythm Technologies, Inc., HHS OCR, Oct 3, 2026, 8,179,772

Sources and method

Records as published by SEC Form 8-K. Letter facts (discovery date, monitoring, third party) are read from the consumer letter the agency posted, 1 letter read for this incident, and quoted so you can check them. Texas and HHS publish no letters. First-seen times on each record page. Spot an error? Email support@breachtally.com with this page link.